Junglewise Threat Intelligence

CVE-2017-3248: Oracle WebLogic Server deserialization RCE in Core Components

CVE-2017-3248 · Severity: critical · CVSS 9.8 · Published 2017-01-27

Technologies: Oracle WebLogic Server. Vendors: Oracle.

Executive brief

A critical vulnerability exists in Oracle WebLogic Server, a platform used for building and deploying enterprise Java applications. An unauthenticated attacker can remotely take full control of the server over the network. This could lead to the theft of sensitive business data, complete service disruption, or the server being used as a foothold for further attacks into the corporate network.

Technical details

This vulnerability is a Java deserialization flaw within the Oracle WebLogic Server Core Components. It stems from the way the server handles RMI (Remote Method Invocation) registry UnicastRef objects over the T3 protocol. An unauthenticated attacker can send a specially crafted serialized object that forces the server to establish a JRMP (Java Remote Method Protocol) connection back to an attacker-controlled server. When the WebLogic server deserializes the response from the attacker's server, it executes arbitrary code. The vulnerability bypasses previous blacklisting fixes and affects versions 10.3.6.0, 12.1.3.0, 12.2.1.0, and 12.2.1.1. Oracle addressed this in the January 2017 Critical Patch Update and subsequent releases like 12.2.1.2.

Affected products

  • Oracle WebLogic Server 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1, 12.1.2.0

Timeline

  • 2016-03-03: disclosed: Issue discovered by Tenable research
  • 2017-01-27: advisory: Oracle published security advisory and patches
  • 2018-07-07: other: Public exploit/POC released by third party

References

Related threats